You ask ChatGPT "which sunscreen brand is good," and it confidently recommends a brand you've never heard of. You click through the search results and find several glowing reviews—but they're all fake. This isn't hypothetical: it's the real scenario exposed on CCTV's March 15, 2026 consumer-rights gala, where commercial GEO (generative engine optimization) operators showed they could push a fake brand to the top of mainstream AI assistants' recommendations within hours by seeding fake reviews online.
The question is: how easy is this, really? Is one fake webpage enough?
A multi-institution research team built FORGE (Fake Online Recommendation Generation Evaluation), a benchmark with an unsettling answer: a single fake page ranked first in search results can fool recommendations 27% of the time on the most vulnerable models. Even more surprisingly—the "smarter" the model, the easier it is to fool.
What Is an Adversarial Recommendation Attack?
Imagine buying a phone online. The normal flow: a search engine returns webpages, an AI assistant reads them and recommends. The attacker simply inserts a carefully forged page into those search results, praising a fake brand.
This differs from traditional training-data poisoning, which requires hacking into the model's training pipeline. Webpage pollution only requires posting online—anyone who knows SEO can do it. It also differs from prompt injection: the attacker doesn't touch your conversation, only the search results.
FORGE covers 6 product categories (smartphones, dining, skincare, etc.) and tests 12 mainstream models, including closed-source models like GPT-5.4, Claude Opus 4.7, and Gemini 3.1 Pro, plus open-source models like Llama and Qwen.
Five Counterintuitive Findings
1. Bigger models aren't safer than smaller ones. Closed-source commercial models are not less susceptible than open-source ones. GPT-5.4 and Claude Opus 4.7 are more vulnerable than 7B open-source models in some categories.
2. Reasoning becomes a weakness. When "deep thinking" mode is enabled, susceptibility rises. The reason is subtle: reasoning makes models read search results more deeply—but most of that deep reading is shallow. The model sees the fake brand and adopts it. Only rarely does a model truly scrutinize evidence reliability. Researchers found that models that successfully resist attacks have reasoning chains 6x longer than fooled models—they didn't "miss" the fake brand; they saw it, thought carefully, and rejected it.
3. Fooled models fabricate social proof. The creepiest finding: after recommending a fake brand, a model doesn't just say "Brand X is decent"—it invents nonexistent social proof like "many users report Brand X works well" or "Brand X ranks highly in multiple reviews." The model covers its own lie: first persuaded by fake evidence, then actively generating more fake evidence to support its recommendation.
4. Skepticism prompts backfire. Researchers tried telling models in the system prompt to "be wary of unfamiliar brands." Instead, closed-source models' susceptibility rose by 24 percentage points; Gemini 3.1 Pro's jumped 44 points. Like reasoning, skepticism prompts make models examine evidence more deeply—but that scrutiny often makes them trust the fake evidence more.
5. Vulnerability is predictable. If multiple models' brand recommendations for a category are highly consistent without search results (e.g., dining—everyone recommends the famous names), the category is hard to fool. If models already disagree (e.g., smartphones), it's highly vulnerable. Cross-model brand consensus correlates with attack success at r=-0.65.
Defenses: No Silver Bullet
Three defenses were tested:
1. Skepticism prompts: proven counterproductive. 2. Model prior-consensus filtering: only recommend brands the model would recommend without search results. Effective, but kills the ability to recommend new brands—you only ever recommend the "already famous." 3. Cross-document evidence-consistency filtering: only recommend brands mentioned in multiple search results. This lowers attack success too, but sharply reduces recommendation coverage.
The core dilemma: a recommendation system's value lies in discovering new things, while defense is essentially "trust only the known." There is a fundamental tension between safety and usefulness.
Why This Matters
This isn't just a technical problem—it's an ecosystem problem. As AI recommendation systems become the primary gateway for consumer decisions, the trustworthiness of search results becomes the weak link in the entire chain of trust. GEO operators already form a black-market industry—they don't need to hack anything, just manufacture enough fake content online.
The paper's title says it plainly: One Polluted Page Is Enough. A single fake review can topple the most advanced AI recommendation systems. In the real world, attackers won't post just one—they'll post a hundred.
Paper: https://arxiv.org/abs/2606.13610 Code repository: https://github.com/leoluolol/forge-benchmark